SurrealDB Security Flaw Risks Execution

A severe security vulnerability has been identified within the SurrealDB database system. This flaw, tracked as CVE-2024-58366, exposes the internal processing of the database engine to potential manipulation under specific conditions.

Understanding the Vulnerability Scope

The issue resides in the rquickjs Exception::throw_type function. It affects versions of the software released prior to 1.1.1. The nature of the flaw is defined as a format string vulnerability, which occurs when user-supplied input is incorrectly handled as a format string argument rather than literal data.

Operational Risks and Attack Vectors

The risk associated with this flaw is classified as critical, carrying a CVSS score of 8.5. The vulnerability is specifically triggered when scripting is enabled within the SurrealDB environment.

When these specific criteria are met, an attacker possessing scripting privileges can manipulate error inputs. By injecting specific sequences, these attackers can achieve two primary outcomes:

• Reading arbitrary data stored in memory.
• Executing code with the SurrealDB process privileges.

Implications for System Integrity

The presence of this vulnerability suggests that the security boundary between user-supplied scripts and the host process's memory space is effectively breached in affected versions. Because the code execution occurs with the same privileges as the database process itself, the potential impact on the host system is significant. While this report outlines the technical mechanics of the exposure, the necessity for addressing the underlying version discrepancy is clear for maintainers of environments where scripting features are currently active.